Active Directory, Identity Engineer – Journeyman

This is a fully remote position, open to applicants in Illinois.

📋 Description

• Oversee, maintain, update, troubleshoot, and recover Microsoft Active Directory Domain Services.

• Create, modify, disable, delete, and manage authorized AD objects.

• Administer users, computers, groups, service accounts, organizational units, shared resources, and related directory objects.

• Keep up-to-date documentation regarding domain, OU, site, trust, Group Policy, administrative design, architecture, replication, and object management.

• Manage OU-level permissions and delegated administrative access following least-privilege principles.

• Develop, test, deploy, maintain, and address issues with Group Policy Objects and their related settings.

• Configure, validate, monitor, and troubleshoot domain and forest trusts.

• Maintain AD sites, subnets, site links, replication schedules, and the replication topology.

• Provide support for domain controllers, directory databases, SYSVOL, DFS Replication, time synchronization, and AD-integrated DNS dependencies.

• Assist with the installation, configuration, replacement, upgrade, demotion, and retirement of domain controllers.

• Aid in Active Directory version transitions and controlled schema updates or extensions.

• Process approved changes to accounts, groups, permissions, and OUs escalated through Service Desk and access-management workflows.

• Troubleshoot issues related to authentication, authorization, accounts, group membership, policy, trust, replication, and directory permissions.

• Provide advanced support during incidents involving identity, authentication, domain, and access management.

• Collect evidence for root-cause analysis and implement approved corrective and preventive measures.

• Maintain and execute procedures for Active Directory backup, restoration, deleted-object recovery, and forest recovery.

• Support COOP exercises, disaster recovery tests, recovery validation, and continuity events.

• Assist in testing ICAM and identity modernization technologies, including integrations with Okta and other approved identity platforms.

• Validate identity synchronization, authentication flows, attribute mappings, group mappings, account linking, provisioning, and access controls.

• Test approved federation and modern authentication protocols such as SAML, OpenID Connect, OAuth, SCIM, and LDAP.

• Develop test cases, rollback procedures, validation methods, and document defects and test outcomes.

• Coordinate identity-integration efforts with cybersecurity, application, cloud, network, and government identity teams.

• Automate approved AD administration, health validation, reporting, and auditing tasks.

• Implement approved Active Directory security baselines and DISA Security Technical Implementation Guides.

• Assist in vulnerability remediation, Risk Management Framework controls, evidence collection, assessments, and corrective actions.

• Adhere to incident, problem, change, configuration, access, release, security, and quality management processes.

• Provide information on directory service health, risks, issues, recovery, and modernization for program reporting.

⛳️ Requirements

• Active Secret clearance or higher is required.

• Bachelor’s degree in information technology, information systems, or a related field, or equivalent professional experience as permitted by the applicable labor category.

• At least six years of relevant experience in Active Directory administration, identity engineering, Windows infrastructure, systems engineering, or a related technical discipline.

• Direct, hands-on experience in administering Microsoft Active Directory Domain Services within an enterprise setting.

• Experience in managing AD objects, organizational units, Group Policy Objects, trusts, replication, schemas, delegated permissions, and directory recovery.

• Proficient in troubleshooting authentication, authorization, Group Policy, replication, trust, and directory service issues.

• Experience in supporting Active Directory backup, restoration, disaster recovery, or deleted object recovery.

• Familiarity with testing identity integrations or supporting enterprise identity modernization initiatives.

• Understanding of the differences between core AD DS responsibilities and external ICAM, federation, or cloud identity services.

• Knowledgeable in enterprise identity security, least privilege, delegated administration, account management, and access control principles.

• Capable of maintaining architecture diagrams, domain and OU documentation, Group Policy records, recovery procedures, and technical standards.

• Availability to support after-hours maintenance, COOP exercises, disaster recovery testing, and critical incidents as needed.

• Strong written, verbal, analytical, and technical problem-solving skills.

🏝️ Benefits

• Regular full-time employment.

• Remote work arrangement.

• Preference for candidates located in the Chicago area.

• Opportunities for after-hours maintenance, COOP exercises, incident response, on-site support, or travel as required.